Aikido runs a platform across code, dependencies, secrets, and IaC, and publishes Code Security Audit. Aevral is built for who has access to what. Keep both.
| Row | Aikido | Aevral |
|---|---|---|
| Question it answers | What does the platform surface, and what does Code Security Audit publish on source? | Who has access to what, and did this change widen it? |
| Stated job | SAST, dependencies, secrets, IaC, pentest; Code Security Audit and Deep Review as published | Authorization, IDOR, and business-logic reading of the repo and PR diff |
| Where it runs | The Aikido platform, Code Security Audit, and Deep Review, per Aikido's docs | Console scan on the default branch; PR review opt-in per organization |
| Unit of work | The platform finding, or a Code Security Audit finding with evidence | The finding as a lead with evidence, across files |
| Complementary? | Yes, on the platform | Yes |
Aikido is built as one platform for SAST, dependencies, secrets, infrastructure-as-code, and pentest. Keep that platform. Aikido also publishes Code Security Audit and Deep Review: agentic reading of source for authorization, IDOR, and business-logic access control. Aevral's whole-repo scan is built for that reading; its PR review rides the same App as an opt-in add-on.
This page keeps the boundary honest: platform surfaces on one side, the specialist GitHub App on the other. Org-priced scan, fix prompt for the coding agent you already use, findings as leads. Keep both.
Aikido
Aikido is a developer security platform: SAST, dependencies, secrets, IaC, and pentest. It also publishes Code Security Audit and Deep Review, agentic reading of source for authorization, IDOR, and business logic. Aevral is built for that reading. Keep the platform.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change relaxes the admin section's gate from an admin role to any signed-in user, so support staff can read admin reports during an incident without an admin account. The code is valid and the reports open for everyone signed in.
// gate the admin sectionrouter.use("/admin", requireRole("admin"))router.use("/admin", requireSignedIn())router.use("/admin", adminRoutes)The gate went from a role to a login. Every signed-in user, whatever their role, now reaches the admin section and its reports. The change is small, valid, and answers a real support need, and it still widens who has access to what. Aevral is built to read a diff for the gate itself: not whether the code runs, but who it lets through.
Keep Aikido for SAST, dependencies, secrets, IaC, and the live pentest; run Aevral for the authorization and business-logic reading of the repository, and of every pull request through its opt-in PR review.
No. Aikido does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Aikido and Aevral on the works-alongside page.
Primary sources: Aikido Code Security Audit; Aikido documentation; Aevral whole-repo scan; Aevral PR security review.
One GitHub App. A report with evidence. A prompt for the agent you already use.